SFC June 2026 Cybersecurity Circular on AI-Enabled Attacks

Video transcript

AI is shrinking the gap between disclosure and exploitation. The SFC's June 2026 circular tells crypto platforms what to change.

The SFC names three shifts: AI getting better at finding zero-days, chaining lower-rated bugs into high-impact attacks, and cheaper phishing and deepfakes.

HKCERT recorded 15,877 cybersecurity incidents in Hong Kong in 2025, up from 12,536 in 2024.

There is no transition period. VATPs are generally expected to implement every measure, and senior management is ultimately responsible.

Tag every asset as exposed, business critical or third-party dependent. Triage new advisories the same day. Then patch outside routine cycles, with containment while a fix is pending.

Assume any user, device or account may be compromised. Apply least privilege and micro-segmentation, treat untrusted inputs as adversarial, and require maker-checker for high-impact actions.

The SFC warns AI-enabled attacks may outpace normal detection and response, so pre-plan containment and test it. For a VATP, Guardian would expect suspending withdrawals and revoking API keys.

Detection and supplier oversight tighten too, with red teaming that simulates AI attacks and AI-aware supplier reviews.

Guardian's Shield pentests your internet exposure around the clock, Helix tests continuously, advisories are matched to your stack, and Critical alerts carry a 15-minute SLA.

Guardian's regulatory readiness assessment maps each provision to a control, its evidence and any gap. Read the full article, or talk to Guardian.

On June 2, 2026, Hong Kong's Securities and Futures Commission (SFC) issued a circular on AI-enabled cyberattacks.

It is addressed to licensed corporations, SFC-licensed virtual asset service providers and their associated entities. It sets no transition period.

Crypto platforms are expected to apply the full list. The Appendix says VATPs, like licensed corporations in electronic trading, "are generally expected to implement all" of its measures.

This article explains the technical and security side of the SFC's circular on enhanced cybersecurity measures against AI-enabled cyberattacks (26EC32). It is not legal advice; confirm how it applies to you with counsel.

What the SFC Has Seen

The SFC says recent AI capabilities "may significantly reduce the expertise, cost, and time" needed to find and exploit vulnerabilities.

It names three developments:

• Zero-days: frontier models are getting better at finding flaws developers have not detected.
• Chained bugs: they can link several "lower risk-rated" vulnerabilities into a high-impact attack.
• Cheaper social engineering: AI tools lower the barrier for phishing, deepfake impersonation and reconnaissance.

The result, it says, is more vendor patches and a rapidly shrinking gap between disclosure and exploitation.

Incidents are rising too. HKCERT figures cited by the SFC show 15,877 cybersecurity incidents in Hong Kong in 2025, up from 12,536 in 2024.

Who owns it

Senior management, including the Manager-in-Charge of Information Technology (MIC-IT), is "ultimately responsible" for cybersecurity risk.

The MIC-IT should ensure framework changes are reviewed and approved, and that enhancements are implemented "properly and promptly".

Inventory and Patching

A same-day inventory

Paragraph 6 makes the asset inventory the foundation: hardware, software, network infrastructure, databases and cloud services.

Firms should identify which assets are externally exposed, business critical or dependent on third-party components.

The inventory should be current enough for "same-day prioritisation and containment decisions" when a new vulnerability emerges.

For a VATP, the test is simple. When an advisory lands, can you say that day whether it touches the wallet service, the trading engine or a signing server?

Patching outside the cycle

Paragraph 9 asks for procedures for urgent and critical fixes that fall outside routine patching cycles, especially for business critical components.

Firms should also resource for a surge in patching. The Appendix adds:

• Retire legacy systems and end-of-life software.
• Rank fixes by severity, exploitability, exposure, data sensitivity and system criticality.
• Automate patch deployment, including fixes for lower-rated vulnerabilities.
• Use a WAF, network controls or containment while a patch is pending.
• Reassess remediation timelines, risk tolerance and patch deferral practices.

Access and Untrusted Inputs

Paragraph 10 sets the zero-trust principle. Design controls assuming "any user, device, privileged account or network component may be compromised".

Paragraph 11 then lists four controls:

1. Least privilege on business critical components, including connectors and tool permissions.
2. Stronger firewalls and segmentation, with micro-segmentation where feasible.
3. Treat untrusted inputs as adversarial, so they cannot alter system instructions or trigger privileged actions.
4. Maker-checker controls for high-impact actions.

The Appendix adds phishing-resistant MFA on admin, cloud and privileged accounts, just-in-time access, hardening, and test environments without unnecessary production data or credentials.

On a crypto platform, we would treat withdrawal whitelist changes, hot wallet top-ups, signer changes and admin role grants as high-impact.

Client login and device binding have their own deadline. Circular 26EC35 expects phishing-resistant methods, not one-time passwords, by July 8, 2027 at the latest.

AI models inside the firm

Paragraph 8 covers a firm's own AI language models, whether built in-house, supplied by a group company or vendor, or open source.

The SFC says they may amplify cyber risk through adversarial attacks, data leakage and system prompt override.

Those risks belong in the cybersecurity framework and incident handling, taking into account the SFC's November 2024 circular on generative AI language models.

One example: a support agent that reads client emails should not be able to start a withdrawal. Our MCP pentesting checklist shows how to test tool permissions.

Detection and Suppliers

Paragraph 12 asks for stronger detection of anomalies in client trading and system activity, and better threat intelligence.

The Appendix gives examples:

• Proactive scanning of systems, networks and internal code repositories.
• Regular review of anomaly detection rules against emerging attack patterns.
• Periodic red team exercises that simulate AI-enabled attacks.
• Threat intelligence feeds, with prompt assessment of zero-days and upcoming patches.

Firms with limited resources may use managed security service providers for testing and threat hunting.

Third parties

Paragraph 13 extends this to providers that support critical operations. Initial and ongoing assessments should factor in AI-enabled threats.

• Assess providers against standards such as ISO/IEC 27001, COBIT or NIST's framework.
• Review critical providers' vulnerability management and patch deployment in depth.
• Plan for concentration risk if a key provider fails.
• Put incident notification, vulnerability disclosure and exit terms in contracts.

For a VATP, wallet and signing software is the obvious case. See securing signing interfaces after Bybit.

Containment Before Escalation

Paragraph 15 is the biggest shift for incident response. The SFC says AI-enabled attacks "may unfold faster than traditional detection-and-response processes can handle".

Relying on post-incident investigation or normal escalation may let an attack continue.

Firms should consider pre-planned containment: the ability to block malicious activity, isolate affected systems and restrict access rapidly.

The Appendix asks incident plans to specify:

• Roles and escalation across IT, risk, compliance and senior management.
• Pre-authorized containment actions to take immediately.
• Recovery steps aligned with recovery time and recovery point objectives.
• Communications with clients, providers, law enforcement and the SFC.

For a VATP, we would expect that list to include suspending withdrawals, halting hot wallet outflows and revoking API keys.

Paragraph 16 asks for regular tests through tabletop exercises, simulated attacks or other means.

Checklist for the MIC-IT

Each line maps to the circular. Keep a dated record for each.

1. Every asset is tagged as exposed, business critical or third-party dependent (paragraph 6).
2. A new critical advisory can be triaged against the inventory the same day.
3. An out-of-cycle patch procedure exists, with named approvers (paragraph 9).
4. Withdrawal, wallet and signer changes need maker-checker approval (paragraph 11).
5. AI tools and connectors cannot trigger privileged actions from untrusted input.
6. Critical suppliers have had an enhanced assessment (paragraph 13).
7. Pre-authorized containment actions are written down, with who may trigger them.
8. The incident plan has been exercised, and lessons recorded (paragraph 16).

For the SFC's other crypto circulars, see our guides to custody and cold wallets and tokenized fund smart contracts.

How Guardian Helps

Guardian's Managed Security works on the areas this circular says move fastest: exposure, advisories, testing and response.

• Shield discovers what you expose to the internet, then runs reconnaissance and pentests against it around the clock.
• Helix, Guardian's AI auditor, tests contracts, backend services, infrastructure and web apps continuously. Only human-verified findings reach you.
• Advisories are matched to your stack in real time, and an engineer works the patch with you.
• Monitoring runs 24/7, with a 15-minute SLA on Critical alerts.

Guardian's regulatory readiness assessment lists each provision with the control that meets it, the evidence that proves it, and any gap.

Frequently Asked Questions

Does the SFC's AI cyberattack circular have a deadline?

No. It was issued on June 2, 2026 with no transition period or implementation date. The SFC says it may issue further guidance, review firms' preparedness or take supervisory action where appropriate.

Who does circular 26EC32 apply to?

Licensed corporations, SFC-licensed virtual asset service providers and their associated entities. VATPs, licensed corporations in electronic trading and Type 13 depositaries are generally expected to implement every Appendix measure. Others should consider them in proportion to their risks.

What does the SFC mean by untrusted inputs?

External content, including material retrieved from apps, emails, documents and webpages. Firms should treat it as potentially adversarial and stop it from directly altering system instructions or triggering privileged actions. That matters most where AI tools act on such content.

Does the circular call for red team testing?

The Appendix lists periodic red team exercises that simulate AI-enabled attacks, and VATPs are generally expected to implement every Appendix measure. Incident plans should also be tested regularly (paragraph 16).

Sources

• SFC: Circular to licensed corporations, SFC-licensed virtual asset service providers and associated entities: Enhanced cybersecurity measures to address evolving risks arising from artificial intelligence-enabled cyberattacks, 26EC32 (June 2, 2026)
• SFC: Appendix to 26EC32: Examples of controls and procedures to manage and mitigate potential risks associated with AI-enabled cyberattacks (June 2, 2026)
• SFC: Circular on implementing robust authentication methods and adequate monitoring and surveillance measures, 26EC35 (July 9, 2026)
• Guardian: Managed Security
• Guardian: Guardian Announces Managed Security
• Guardian: Regulatory and Compliance Assessments